CRA Article 14 reporting clock
Deadlines run from the moment the manufacturer becomes aware. Applies from 11 September 2026.
Trigger
Actively exploited vulnerability — Art 14(1)–(2)
Severe incident affecting product security — Art 14(3)–(4)
Became aware at (your local time)
Now
Early warning · within 24 hours
—
Notification · within 72 hours
—
Via the single reporting platform (Art 16), to the coordinating CSIRT and ENISA. Not legal advice.
EU CRA Compliance →